From: Debian LibreOffice Maintainers <debian-openoffice@lists.debian.org>
Date: Sat, 6 Jun 2026 20:12:08 +0000 (+0200)
Subject: CVE-2026-6039
X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u6^2~7
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=f54d65a424fe9f359ccb32bb9a47c7e57d482a1d;p=libreoffice.git

CVE-2026-6039

CVE-2026-6039: DXF heap-buffer-overflow in DrawLWPolyLineEntity

It looks like our oss-fuzz efforts didn't find this because we capped
the dxffuzzer.options size at 64KB which is too small to capture this
issue.

From cf825c7608ded2cb1b7c846bde15d0ebcf6a5c44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Thu, 9 Apr 2026 17:23:39 +0100
Subject: [PATCH] stay within max Polygon points

Change-Id: I02e34bb413e6332d8c5683504a63a591a33d7730
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203575
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203626
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>

Gbp-Pq: Name CVE-2026-6039.diff
---

diff --git a/vcl/source/filter/idxf/dxf2mtf.cxx b/vcl/source/filter/idxf/dxf2mtf.cxx
index 53bdcfd98bc..86b60e3b6de 100644
--- a/vcl/source/filter/idxf/dxf2mtf.cxx
+++ b/vcl/source/filter/idxf/dxf2mtf.cxx
@@ -554,13 +554,17 @@ void DXF2GDIMetaFile::DrawPolyLineEntity(const DXFPolyLineEntity & rE, const DXF
 void DXF2GDIMetaFile::DrawLWPolyLineEntity(const DXFLWPolyLineEntity & rE, const DXFTransform & rTransform )
 {
     sal_Int32 nPolySize = rE.aP.size();
-    if (!nPolySize)
+    if (nPolySize <= 0 || nPolySize > SAL_MAX_UINT16)
+    {
+        SAL_WARN("vcl.filter", "DXF2GDIMetaFile::DrawLWPolyLineEntity: invalid num of points: " << nPolySize);
         return;
+    }
 
-    tools::Polygon aPoly( static_cast<sal_uInt16>(nPolySize));
-    for (sal_Int32 i = 0; i < nPolySize; ++i)
+    sal_uInt16 nSize = static_cast<sal_uInt16>(nPolySize);
+    tools::Polygon aPoly(nSize);
+    for (sal_uInt16 i = 0; i < nSize; ++i)
     {
-        rTransform.Transform( rE.aP[ static_cast<sal_uInt16>(i) ], aPoly[ static_cast<sal_uInt16>(i) ] );
+        rTransform.Transform( rE.aP[i], aPoly[i] );
     }
     if ( SetLineAttribute( rE ) )
     {
diff --git a/vcl/workben/dxffuzzer.options b/vcl/workben/dxffuzzer.options
index 678d526b1ea..96521611204 100644
--- a/vcl/workben/dxffuzzer.options
+++ b/vcl/workben/dxffuzzer.options
@@ -1,2 +1,2 @@
 [libfuzzer]
-max_len = 65536
+max_len = 524288